first stab at whitelist and warning message for sandbox